Detects social engineering messages that push remote access tool deployment by framing installation steps as a document/share notification. The rule looks for inbound or internal messages containing references to popular remote access tools (Zoho Assist, AnyDesk, ScreenConnect, TeamViewer, Splashtop) or generic remote-support language in the message body. It then requires installation-oriented language (e.g., 'allow the installation', 'installation to finish', 'select ... yes/allow') to indicate step-by-step instructions. Finally, it checks for framing cues typical of phishing templates, such as 'important viewing note' or phrases indicating a document/report was shared (e.g., 'has shared a report/document'). The combination suggests a lure to persuade the recipient to install remote access software under false pretenses, enabling persistence or unauthorized access. The rule focuses on content analysis of chat/email-like threads to identify the precise social-engineering narrative rather than payload behavior. This helps preempt attempts to compromise endpoints by tricking users into installing remote tooling. The detection is targeted at messaging content rather than external network or host behavior, providing signal for user awareness, containment, and potential block/deny actions before installation occurs.